Search

Remote Power Analysis (RPA) attacks use transient voltage fluctuation side channels detected via delay sensors/ on-chip voltage sensors to reveal secret keys from cryptographic circuits. The state-of-the-art research proposed five on-chip voltage sensors for Field Programmable Gate Arrays (FPGAs). This paper proposes a novel on-chip voltage sensor, 1LUTSensor, which uses FPGA LookUp Table (LUT) structure to deduce voltage fluctuations. 1LUTSensor uses LUT multiplexers to create a run-time adjustable delay line to detect voltage fluctuations and uses dedicated paths which are fabricated signal connections and cannot be changed in the FPGA LUT to form the delay line. 1LUTSensor uses only a single LUT and a single flip-flop for the delay line to sense voltage fluctuations and uses a single tapped delay element for calibration. The output of the 1LUTSensor is a single bit. Compared to the state-of-the-art on-chip sensors, 1LUTSensor proposed in this paper is the smallest and fastest on-chip voltage sensor proposed thus far. 1LUTSensor is at least 3x smaller than the smallest on-chip sensor proposed in the literature. Compared to the state-of-the-art, the proposed 1LUTSensor can be operated at 600MHz. 1LUTSensor is evaluated using RPA attacks, and a complete secret key of an AES circuit can be extracted within 100,000 traces.

State-of-the-art sensors for measuring FPGA voltage fluctuations are time-to-digital converters (TDCs). They allow detecting voltage fluctuations in the order of a few nanoseconds. The key building component of a TDC is a delay line, typically implemented as a chain of fast carry propagation multiplexers. In FPGAs, the fast carry chains are constrained to dedicated logic and routing, and need to be routed strictly vertically. In this work, we present an alternative approach to designing on-chip voltage sensors, in which the FPGA routing resources replace the carry logic. We present three variants of what we name a routing delay sensor (RDS): one vertically constrained, one horizontally constrained, and one free of any constraints. We perform a thorough experimental evaluation on both the Sakura-X side-channel evaluation board and the Alveo U200 datacenter card, to evaluate the performance of RDS sensors in the context of a remote power side-channel analysis attack. The results show that our best RDS implementation in most cases outperforms the TDC. On average, for breaking the full 128-bit key of an AES-128 cryptographic core, an adversary requires 35% fewer side-channel traces when using the RDS than when using the TDC. Besides making the attack more effective, given the absence of the placement and routing constraint, the RDS sensor is also easier to deploy.

Field-programmable gate arrays (FPGAs) deployed on commercial cloud services are increasingly gaining popularity due to the cost and compute benefits offered by them. Recent studies have discovered security threats than can be launched remotely on FPGAs that share the logic fabric between trusted and untrusted parties, posing a danger to designs deployed on cloud FPGAs. With remote power analysis (RPA) attacks, an attacker aims to deduce secret information present on a remote FPGA by deploying an on-chip sensor on the FPGA logic fabric. Information captured with the on-chip sensor is transferred off the chip for analysis and existing on-chip sensors demand a significant amount of bandwidth for this task as a result of their wider output bit width. However, attackers are often left with the only option of using a covert communication channel and the bandwidth of such channels is generally limited. This paper proposes a novel area-efficient on-chip power sensor named PPWM that integrates a logic design outputting a pulse whose width is modulated by the power consumption of the FPGA. This pulse is used to clear a flip-flop selectively and asynchronously, and the single-bit output of the flip-flop is used to perform an RPA attack. This paper demonstrates the possibility of successfully recovering a 128-bit Advanced Encryption Standard (AES) key within 16,000 power traces while consuming just 25% of the bandwidth when compared to the state of the art. Moreover, this paper assesses the threat posed by the proposed PPWM to remote FPGAs including those that are deployed on cloud services.

We report a novel on-chip approach for surface-enhanced Raman spectroscopy (SERS) using a plasmonic slot waveguide. The Raman signal is excited via free-space excitation and is collected by the waveguide. A significant improvement of the signal-to-background-ratio (SBR), as compared to the case of back-scattered Raman spectroscopy with waveguide-mode excitation, is demonstrated using a silicon nitride plasmonic slot waveguide with a 7-mm access waveguide. The flexible adjustment of the incident angle in free space and modification of waveguide geometry enables the further optimization of the pump-to-Stokes conversion efficiency. The combination of high SBR and long access waveguide allows the integration with additional photonics devices (sources, filters, spectrometers) on the same chip. [ABSTRACT FROM AUTHOR]

Abstract Merging photonic structures and optoelectronic sensors into a single chip may yield a sensor‐on‐chip spectroscopic device that can measure the spectrum of matter. In this work, an on‐chip concurrent multiwavelength infrared (IR) sensor, which consists of a set of narrowband wavelength‐selective plasmonic perfect absorbers combined with pyroelectric sensors, where the response of each pyroelectric sensor is boosted only at the resonance of the nanostructured absorber, is proposed and realized. The proposed absorber, which is based on Wood's anomaly absorption from a 2D plasmonic square lattice, shows a narrowband polarization‐independent resonance (quality factor – Q of 73) with a nearly perfect absorptivity as high as 0.99 at normal incidence. The fabricated quad‐wavelength IR sensors exhibit four different narrowband spectral responses at normal incidence following the predesigned resonances in the mid‐wavelength infrared region that corresponds to the atmospheric window. The device can be applied for practical spectroscopic applications such as nondispersive IR sensors, IR chemical imaging devices, pyrometers, and spectroscopic thermography imaging.

The modern integrated circuit (IC) manufacturing process has exposed the fabless semiconductor industry to hardware Trojans that threaten circuits bound for critical applications. This paper investigates an on-chip sensor's effectiveness for Trojan detection in an application specific integrated circuit (ASIC) and proposes new techniques to improve the sensor's sensitivity to Trojan switching activity. The sensors serve as power supply monitors by detecting fluctuations in their characteristic frequencies due to malicious inclusions (i.e. hardware Trojans) in the circuit under authentication. Our proposed on-chip structure was implemented and fabricated on an ASIC test chip using IBM 90nm technology with controlled hardware Trojans. This work analyzes the impact of both sequential and combinational Trojans with varied partial activity, area, and location on the proposed on-chip structure and demonstrates that stealthy Trojans can be effectively detected with this technique, even when obfuscated by circuit switching activity and process and environmental variations. [ABSTRACT FROM AUTHOR]

Merging photonic structures and optoelectronic sensors into a single chip may yield a sensor‐on‐chip spectroscopic device that can measure the spectrum of matter. In this work, an on‐chip concurrent multiwavelength infrared (IR) sensor, which consists of a set of narrowband wavelength‐selective plasmonic perfect absorbers combined with pyroelectric sensors, where the response of each pyroelectric sensor is boosted only at the resonance of the nanostructured absorber, is proposed and realized. The proposed absorber, which is based on Wood's anomaly absorption from a 2D plasmonic square lattice, shows a narrowband polarization‐independent resonance (quality factor – Q of 73) with a nearly perfect absorptivity as high as 0.99 at normal incidence. The fabricated quad‐wavelength IR sensors exhibit four different narrowband spectral responses at normal incidence following the predesigned resonances in the mid‐wavelength infrared region that corresponds to the atmospheric window. The device can be applied for practical spectroscopic applications such as nondispersive IR sensors, IR chemical imaging devices, pyrometers, and spectroscopic thermography imaging. [ABSTRACT FROM AUTHOR]

This article proposes a new class of sensors for built-in test in RF devices. These sensors are placed in close proximity to the DUT on the same substrate without being electrically connected to it. Instead, they monitor it by virtue of being subjected to the same process variations. The authors also describe other types of sensors they have studied, including DC probes, an envelope detector, and a current sensor. [ABSTRACT FROM PUBLISHER]